Kaspersky Lab Seeks Injunction Against US Government Ban

[Reefa]

Revenues and reputation have taken a hit in the wake of the US Department of Homeland Security's decision to prohibit use of its products and services by the feds, the company says.

 

Security vendor Kaspersky Lab has filed a motion for a preliminary injunction in its lawsuit challenging the US government's recent ban on the use of the company's anti-malware products by federal agencies.

 

The ban has seriously hurt Kaspersky Lab's reputation and revenues and should be overturned expeditiously, the company argued in the motion filed Wednesday in US District Court for the District of Columbia.

 

The US Department of Homeland Security (DHS) last September ordered the removal of Kaspersky Lab software and services from all federal information systems covered under the Federal Information Systems Management Act, and banned further use of all products from the company.

 

The ban, issued under DHS Binding Operational Directive (BOD) 17-01, stemmed from concerns about the firm's ties to the Russian government and the belief that Russian agents had used the company's software to steal sensitive data from US government systems.

 

In its motion, Kaspersky Lab claimed the ban has caused considerable reputational damage and loss of sales to the company in North America. The debarment has precluded Kaspersky Lab from doing business with the US federal government, while hurting its consumer and commercial business as well, the motion said. US retailers that used to carry its products have now removed it from their shelves and are encouraging customers to switch to rival products, resulting in an overall decline in North American sales of over 50% during the second half of 2017.

 

According to Kaspersky Lab, the government issued the BOD without giving the company enough notice or enough of an opportunity to contest the evidence for the ban, thereby violating Fifth Amendment rights to due process. The BOD is also not supported by any substantial evidence and is therefore both "arbitrary and capricious," Kaspersky Lab said in seeking an injunction overturning the ban.

 

"DHS used the BOD to achieve a preordained result—the immediate debarment of Kaspersky Lab, and the consequential and foreseeable adverse effect on its U.S. commercial sales," the security vendor said in its motion.

 

"The BOD achieved this result while depriving Kaspersky Lab of any meaningful or constitutionally sound process to challenge the tenuous, often anonymous, and uncorroborated media stories and other self-serving public statements which DHS relied upon to justify its action."

 

Ed McAndrew, a trial lawyer at Ballard Spahr, says Kaspersky Lab's injunction is curious in what it does not seek.

 

After the ban went into effect, it was codified into law under the 2018 National Defense Authorization Act, he says, and as a result, the government will likely argue that Kaspersky’s challenge to the agency actions is moot.

 

Kaspersky Lab is attempting to use the Administrative Procedures Act (APA) to challenge DHS's administrative actions.  But "there's no need to focus on the administrative action because we now have the ban codified as a law," McAndrew says. 

 

In addition, the DC federal court has previously already ruled in another case that the APA does not provide a basis for judicial review under FISMA, he adds.

 

The security vendor's bid to get a temporary injunction — and eventually a permanent injunction— against the ban faces other legal challenges as well, McAndrew notes. To obtain injunctive relief the company will have to prove a variety of things, including the fact that it will suffer irreparable harm, and that issuing an injunction would be in the public interest. It is unlikely that the company will be able to satisfy any, let alone all, of the requirements, he says.

 

"Winning the case may not be Kaspersky's only objective," however, McAndrew notes. "Seeking injunctive relief will provide Kaspersky with a public judicial forum in which to air its dispute with the government's action – and perhaps to attempt to repair its reputation."

 

If a hearing is held, Kasperksy Lab will have an opportunity to publicly present evidence disputing the disbarment while requiring the government to present public proof of the basis for its decision to ban Kaspersky Lab products, he says.

 

source

[straycat19]

Kaspersky is wasting its time and money.  No company can force a government to use its products.  Any security professional will testify that it is impossible to audit/vet their software because it is constantly changing and therefore it cannot be certified as clean.  Every computer store, or store that sells software, even Walmart, took it off their shelves. Nothing that comes out in this trial will change what has already happened.  I don't see that its reputation has been tarnished, it is just a matter of security, and security concerns trump everything.

[Tweety.Abd]

Kaspersky is better than any US antivirus software by a long shot. The only possible alternative is BitDefender.

[Jogs]

Every one using Kaspersky should start using McAfee.

[Alanon]

 

12 hours ago, straycat19 said:

Kaspersky is wasting its time and money.  No company can force a government to use its products.  Any security professional will testify that it is impossible to audit/vet their software because it is constantly changing and therefore it cannot be certified as clean.  Every computer store, or store that sells software, even Walmart, took it off their shelves. Nothing that comes out in this trial will change what has already happened.  I don't see that its reputation has been tarnished, it is just a matter of security, and security concerns trump everything.

 

The issue for Kaspersky is not only losing government-related revenue but also losing all the regular users, wary of a controversy that amounts to a bonified witch-hunt. When you think about it, a governmental ban on the use of a security product doesn't seem too far off from a nation-wide Surgeon General's warning. After all, why should you use a product that's not good enough for your own Government? On the other hand, I don't believe anyone ever doubted that the software is in some way difficult to analyse. After all, if cracking it open were so easy, reverse engineering high-level malware would be that much easier. It's interesting to note that very few people have questioned Kaspersky's security measures - almost no one thought to entertain the notion of it being hacked. Instead, they all went for the theory of willful malice on their part.

 

This leads to the second part of Kaspersky's problem and the heart of the controversy, the old schtick about information peddling. All tech companies want to conceal the fact that user data is the most valuable commodity. I recall reading some article drawing a parallel between Kaspersky trading user stats and information to the FSB, and the now much well-regarded BitDefender's proud declaration of doing the same for the FBI. For the common user, both are equally wrong, and it reverts to a narrow-minded side-picking. It seems to me that this move is not about restoring the right of Kaspersky software to be used as much as an attempt to curb the very notion that it is indeed not secure by virtue of trading the data collected from its users. The problem that I and many others have with the situation, is that we believe it's a separate conversation. 

[straycat19]

10 hours ago, Jogs said:

Every one using Kaspersky should start using McAfee.

 

Using McAfee is like using nothing, so save your money.  We dropped McAfee AV 16 years ago when it didn't protect us from blaster and other malware.

11 hours ago, Tweety.Abd said:

Kaspersky is better than any US antivirus software by a long shot. The only possible alternative is BitDefender.

 

Invalid statement.  Kaspersky, BitDefender, and Symantec run neck and neck in the AV tests.  We have been using Symantec Endpoint Protection for 4 years without one malware incident, and that is on 21,000 plus computers.